Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On AIX 6100-05-01-1016 I accidentally killed the sshd. But for a suprise it still was running. Why? I did a:

kill PID

Q: ..so sshd doesn't reacts to normal kill signal? or are there any default security methods that starts an sshd if the old one get's killed?

share|improve this question
1  
which flavour of Unix is this ? After the kill command, does it still have the same process id ? –  Andre Holzner Aug 30 '11 at 5:45
    
AIX 6100-05-01-1016 –  LanceBaynes Aug 30 '11 at 12:53
add comment

3 Answers

I can't say for certain these days, but AIX used to run inetd. This is a daemon that listens to various ports and starts another daemon (like sshd or ftpd) on the connection. Check to see if inetd or xinetd is running (ps -e | grep inet), then look for /etc/inet.d or /etc/xinet.d. Beyond that we would need to see what is running (ps axo pid,cmd).

share|improve this answer
    
but doesn't inetd just start the corresponding daemon when a connection is made to a given port ? i.e. would one see an sshd process before an actual connection is made ? (rather than just inetd listening on port 22 ?) –  Andre Holzner Aug 30 '11 at 5:47
add comment

There is a master sshd process that listens to incoming connections, and in addition (for recent versions of OpenSSH) there are two processes called sshd for each incoming SSH connection, one running as root and the other running as the logged-in user. If your OpenSSH is compiled without privilege separation (I don't know whether that's supported on AIX), there'll be a single sshd process per connection in addition to the main one.

You must have killed either a per-connection sshd or the master process, but not both. If you can still logged in over SSH, then what you killed was a per-connection process.

share|improve this answer
add comment

Maybe there is a "hidden" script that checks that sshd runs or not, and if it doesn't run, it starts it.

share|improve this answer
    
that's why I wonder whether after killing it it still has the same process id or not (see my comment above) –  Andre Holzner Aug 30 '11 at 14:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.